Suppose you have information from more than one image in your database and want to see if there are any dlls/processes/files in one image not represented in the others:

select * from dlls where path not in (select path from dlls where memimage is not [image name])

Suppose you don't care about dlls with a certain path, like winsxs for example:

select * from dlls where path not in (select path from dlls where memimage is not [image name]) and path not like '%winsxs%';

Want to output all files in alphabetical order?

select * from files order by file;

or by PID?

select * from files order by pid;

Now that we have sqlite output for some of the scanning plugins we can quickly compare for information missing from regular plugins. Here's an example of pslist vs psscan3 on an image released by Moyix in his post releasing psscan3:

select psscan3.pid, psscan3.ppid, psscan3.ctime, psscan3.pname from psscan3 where pid not in (select pid from process) order by pid;